Summary

• DriveWealth, a US brokerage infrastructure provider and Revolut’s stock trading partner, reported unauthorized access to historical personal data.
• Revolut emailed potentially affected customers and confirmed that a separate email from DriveWealth LLC was genuine.
• The affected data relates to customers who traded US stocks through Revolut before December 2023, which means some records were kept since 2022.
• The case raises questions about cross-border jurisdiction and about data minimization under the EU General Data Protection Regulation (GDPR).
• Breach notification emails are a common template for follow-up phishing, so customers should verify any security updates through the official app.

What happened in the DriveWealth security incident?

DriveWealth confirmed unauthorized access to historical personal data stored on its systems, and Revolut notified customers who may be affected. The incident came weeks after Revolut handled a separate attack in which a fake government request led to the release of customer passports.

PhishFort reviewed a notification Revolut sent to a potentially affected user. Titled “DriveWealth security incident update”, it states that unauthorized access to historical personal data occurred on DriveWealth’s systems and that Revolut is working directly with DriveWealth to determine the scope.

The notice tells the user they were identified as being potentially affected and adds: “You recently received an email from DriveWealth LLC… That email is genuine and you should read it carefully alongside this one.”

This is the DriveWealth email the notice refers to:

Who is affected by the DriveWealth breach?

The affected group is Revolut customers who traded US stocks before December 2023, according to the information shared with customers. Revolut has not published the total number of affected users. Customers who received both the Revolut and the DriveWealth emails should treat themselves as affected.

How did Revolut and DriveWealth communicate the incident?

Both companies contacted affected customers directly by email. Revolut also placed a visible alert on its website and published a help page about the incident.

DriveWealth published a standalone cyber response page on a subdomain (legal.drivewealth.com). At the time of PhishFort’s review, the page was not linked from DriveWealth’s main navigation, which makes it harder for customers to confirm the notice is real.

Why does a partner’s breach expose a fintech’s customers?

A fintech’s customers are exposed wherever their data is stored, including at brokers, payment processors and identity verification vendors. A US broker that executes trades for a European digital bank holds names, addresses and account details of the bank’s customers, so a breach at the broker reaches them directly.

This is a common pattern. The Verizon 2026 Data Breach Investigations Report (DBIR) found third-party involvement in 48% of breaches.

What are the jurisdiction and GDPR questions?

The incident raises an open question about which rules apply: Lithuanian and EU law, where Revolut holds its European banking license, or US frameworks that govern DriveWealth. The answer affects notification deadlines, regulator involvement and customer remedies.

Retention is the second question. If records from as early as 2022 were still held, the case tests the GDPR principle of data minimization, which limits how long personal data can be kept. Financial institutions often cite legal and regulatory duties to retain records, but those duties do not cover every field indefinitely.

How do attackers exploit breach notification emails?

Attackers copy real breach notices because customers expect them and act on them. After a public incident, fake “security update” emails, SMS messages and support accounts often reuse the real subject line, logo and wording, then point to a lookalike domain that asks for login details or identity documents.

Revolut’s notice confirmed that the DriveWealth email was genuine, which helps. A copy of either message can still target a customer. Warning signs include:

• A link that asks you to log in, “verify” your identity or reset your account from the email itself.
• A sender domain that is similar to, but not exactly, revolut.com or drivewealth.com.
• Requests for passwords, one-time codes, card details or ID photos.
• Unsolicited calls or chat messages that reference the incident.

Customers should open the Revolut app directly to check any security notice.

What should fintechs do about third-party risk?

Fintechs can reduce partner risk by limiting what partners hold and planning the customer response before an incident. Practical steps:

1. Map which partners store customer data, which fields and for how long.
2. Set contractual retention limits and deletion obligations that match GDPR data minimization.
3. Agree breach notification timelines and a joint communication plan with each partner.
4. Publish incident pages on the main domain and link them from the homepage, so customers can verify notices.
5. Monitor for lookalike domains and fake support accounts that use the incident as a lure.

How PhishFort helps after a third-party incident

When a partner is breached, attackers impersonate both brands. PhishFort Brand Protection detects lookalike domains, fake support accounts and fake apps that use the incident as a lure, and takes them down with registrars, hosts and platforms.

Frequently asked questions

Was Revolut hacked in the DriveWealth incident?

No. The unauthorized access happened on the systems of DriveWealth, Revolut’s US stock trading partner. Revolut notified potentially affected customers and said it is working with DriveWealth to determine the scope.

Who is affected by the DriveWealth breach?

According to information shared with customers, the incident affects Revolut users who traded US stocks before December 2023. Revolut has not published the total number of affected users.

Is the DriveWealth breach email real?

Revolut told customers that the email from DriveWealth LLC is genuine. Copies of breach notices are a common phishing lure, so check any security notice inside the Revolut app rather than through email links.

What is third-party risk in fintech?

Third-party risk is the exposure a fintech takes on when partners such as brokers, processors or verification vendors store or process its customers’ data. A breach at the partner affects the fintech’s customers even if the fintech’s own systems are secure.

Sources

• DriveWealth cyber response page
• Revolut Help Center: DriveWealth data incident
• Revolut customer notification “DriveWealth security incident update”, reviewed by PhishFort, September 2026.
• Verizon 2026 Data Breach Investigations Report (DBIR).